Phishing is a growing problem where malicious or criminal persons or organisations fool unsuspecting persons or organisations into revealing personal or corporate information, enabling identity theft from the victims. Phishing is usually composed of two parts:
(1) Phishing message delivery; and,
(2) Effecting the phishing attack.
The delivery of a phishing message can occur over any internet application such as e-mail, web browsing, media, instant messaging (IM), and the phisher sends information in these messages hoping to fool the unsuspecting user into unknowingly providing information to the phisher. The messages use social engineering and other techniques used by virus writers to facilitate the phishing attack.
The phishing attack may be one where the user unwittingly executes the attack, or by automated means typically employed by virus writers. For example, the user may be instructed to go to a website, which he/she believes to be their bank, and enter their online banking name and password, but the site is actually operated by the phisher. Similarly, the attack may involve download of malware which automatically captures information (e.g. keyloggers) or exploits vulnerabilities in the user's machine which will cause information to be sent to the phisher, when the user believes it is being sent to a legitimate site.
The interception of the delivery of phishing messages can be achieved by existing content security tools such as anti-spam filters, and web page content blockers (which block generic types of content such as scripts or ActiveX controls).
These defenses can provide good protection from phishing attacks, but some messages will always get through, and may then cause a phishing attack to occur on the victim.
It is also known to inspect web-sites on a regular basis for use of unauthorised logos and messages, and if these are then thought to be used in phishing attacks, the websites are added to block lists used by standard web filtering products.
The current solutions in place to prevent a phishing attack from executing are both slow and incomplete solutions. The systems today which prime spam filters and web filtering blockers are effectively offline, and frequently undertaken by people, such that detecting new phishing messages or websites can take days before this information reaches the defense system.
Similarly, the phishers constantly move their attack sites around, such that they may never be seen by offline detection methods. Typically, phishing sites exist for around 48 hours. Therefore any information such as signatures loaded into defense systems will always be incomplete.